Loading story…
Attackers widely exploited CVE-2023-4966 (Citrix Bleed), a critical flaw in NetScaler ADC and NetScaler Gateway that can leak sensitive information, including session authentication tokens, and enable authentication bypass or session hijacking on affected Gateway or AAA virtual servers. Citrix issued a critical security update and later published investigation recommendations, while defenders reported attack activity beginning in late October and rising sharply through November. One observed technique targeted /oauth/idp/.well-known/openid-configuration with an unusually long Host header to steal session cookies, and a large share of detected attack traffic was traced to infrastructure in Germany, followed by Russia, China, Japan, and the United States.
The vulnerability was later tied to real-world intrusions, including a PLAY ransomware compromise of a professional services firm. After obtaining access through Citrix Bleed, the attackers performed internal reconnaissance to enumerate domain accounts, trusted domains, permission groups, and remote systems before advancing their operation. Security guidance urged organizations running affected NetScaler products, including unsupported 12.1 versions, to apply fixed releases immediately and investigate for signs of token theft or unauthorized session use.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
CISA published guidance in November 2023 for CVE-2023-4966, describing it as a buffer overflow that can disclose sensitive information, including session authentication tokens, on affected Gateway or AAA virtual servers. The guidance noted that stolen tokens could enable session hijacking.
MBSD-SOC observed that detections of exploitation attempts against CVE-2023-4966 increased after the start of November 2023. In its November data, many attack sources were attributed to Germany, followed by Russia, China, Japan, and the United States.
MBSD-SOC reported its first detection of attacks targeting CVE-2023-4966. The observed exploit traffic included a GET request to /oauth/idp/.well-known/openid-configuration with an unusually long Host header intended to obtain a session cookie.
CVE-2023-4966, affecting Citrix NetScaler ADC and NetScaler Gateway, was publicly disclosed. The flaw can enable authentication bypass and theft of sensitive information, including session-related data.
Kroll described a case in which the PLAY ransomware group used Citrix Bleed to gain access to a professional services firm. After initial access, Kroll observed four days of attacker activity including reconnaissance of domain accounts, trusted domains, permission groups, and remote systems.
NetScaler published investigation recommendations related to CVE-2023-4966. The publication marked a vendor response focused on helping customers investigate potential compromise.
Citrix released fixed NetScaler versions for CVE-2023-4966, including updates for supported ADC and Gateway branches while noting unsupported 12.1 versions were also affected. The update addressed the critical flaw later widely referred to as Citrix Bleed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
kroll.com
Open sourcembsd.jp
Open sourcenetscaler.com
Open sourcenetscaler.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers continued to target Citrix NetScaler ADC and NetScaler Gateway systems vulnerable to **`CVE-2025-5777`**, a critical flaw also dubbed **Citrix Bleed 2** that can let unauthenticated attackers obtain sensitive information and hijack user sessions. The vulnerability affects NetScaler deployments configured as described in Citrix’s security bulletin, and public advisories warned that exploitation could also enable arbitrary file reads, broader information disclosure, and denial of service on exposed appliances. SOC telemetry showed exploitation attempts persisted well beyond initial disclosure, with detections recorded from mid-July through September 2025 rather than a brief spike. One observed pattern used a `POST` request to `/p/u/doAuthentication.do` with an unusually long `User-Agent` header to retrieve memory data, while much of the attack traffic was traced to infrastructure in the United States and France. Citrix and national defenders urged organizations to identify affected NetScaler ADC and Gateway versions and apply the vendor’s fixed releases immediately.
Aug 15, 2026
Citrix released security updates for NetScaler ADC and NetScaler Gateway to fix multiple vulnerabilities, led by **CVE-2025-5777**, a critical out-of-bounds read flaw dubbed **"Citrix Bleed 2"** because of its similarity to the 2023 Citrix Bleed bug. The vulnerability affects NetScaler deployments used as a Gateway or virtual AAA server and can let a remote unauthenticated attacker read memory, steal sensitive data such as credentials and configuration, hijack sessions, bypass MFA, and potentially gain broader control of affected systems. Citrix and third-party reporting also highlighted **CVE-2025-6543**, a denial-of-service flaw reported as actively exploited, and **CVE-2025-5349**, a high-severity improper access control issue in the NetScaler Management Interface that could allow unauthorized access from the same network segment. Security researchers reported signs consistent with real-world exploitation of **CVE-2025-5777** for initial access, including hijacked Citrix web sessions reused across multiple IP addresses, LDAP-based Active Directory reconnaissance, and use of **ADExplorer64.exe** against multiple domain controllers. Citrix urged administrators to upgrade affected versions immediately, including NetScaler ADC and Gateway `14.1` before `14.1-43.56`, `13.1` before `13.1-58.32`, `13.1-FIPS/NDcPP` before `13.1-37.235-FIPS/NDcPP`, and `12.1-FIPS` before `12.1-55.328-FIPS`, while noting older `12.1` and `13.0` branches are end-of-life. The company also recommended terminating active ICA and PCoIP sessions after patching HA pairs or clusters and monitoring for anomalous HTTP activity associated with session theft.
Jul 24, 2026
Researchers detailed how ransomware operators linked to **LockBit** exploited Citrix NetScaler ADC and Gateway appliances through the original **CitrixBleed** flaw, `CVE-2023-4966`, using stolen session data to support follow-on access and affiliate infrastructure operations. An OSINT analysis built from joint government and Boeing-published indicators identified additional suspected LockBit infrastructure spanning command-and-control, remote management, FTP, RDP, and OpenVPN services, with recurring hosting patterns and overlaps with tooling and infrastructure previously associated with **Akira**, **Avaddon**, **Cerber**, **BumbleBee**, **Raccoon Stealer**, **RecordBreaker**, **SolarMarker**, **8Base**, and **ShadowSyndicate**. A later root-cause analysis of **CitrixBleed 2**, `CVE-2025-5777`, showed that a malformed POST request to `/p/u/doAuthentication.do` can trigger an out-of-bounds memory disclosure on vulnerable NetScaler devices, leaking up to `0x7F` bytes per request in an authentication failure response. Researchers warned that exposed memory may include credentials, session cookies, and private keys, making the bug a low-noise path to unauthenticated access similar in impact to the earlier CitrixBleed incidents; Citrix issued fixes and defenders were urged to patch immediately, invalidate sessions, reset credentials, rotate certificates and secrets where needed, and review telemetry for LockBit-related indicators, while broad community IOC feeds for suspected **LockBit 5.0** activity have also circulated with explicit false-positive caveats.
Jun 29, 2026